Do not try to predict failure from one ratio. Before hiring an AI services provider, determine whether it has the resources to perform this contract, whether the engagement fits its capacity, which people and third parties sustain delivery, how service will recover, and how your assets can move to another operator. Depth should scale with impact, duration, value, and switching difficulty—not company size alone.
The useful question is not “Is this vendor big?” It is “What evidence shows that this legal entity can meet this commitment, and what controls limit harm if circumstances change?” Current UK guidance calls for transparent, objective, proportionate assessment, accepts alternatives when audited statements are unavailable, and favors relevant mitigations over automatic exclusion. FAR 9.104-1 similarly connects responsibility to resources, schedule, controls, skills, and performance.
The AI Provider Continuity Proof-8: 32 points before award
Score each dimension from zero to four: zero is unknown or unacceptable; one is an assertion; two is partial evidence; three is sufficient evidence plus enforceable mitigation; four is current, tested, monitorable evidence. For a material implementation, use 24 of 32 as a planning threshold, no zero, and at least three in financial capacity, key people, continuity, and exit. Tailor the gate to risk appetite; this is not a credit rating.
- Financial capacity — liquidity, cash, access to capital, and ability to finance performance.
- Revenue resilience — customer concentration, funding, backlog, and exposure to abrupt changes.
- Contract economics — commitment size, working capital, margin, payment timing, and concurrent obligations.
- Insurance and liabilities — coverage, exclusions, limits, litigation, and obligations that could affect delivery.
- Key people — availability, retention, succession, redundancy, and knowledge transfer.
- Dependencies — models, cloud, data, licenses, subcontractors, and single-provider exposure.
- Continuity — recovery, backups, RTO/RPO, communication, testing, and degraded operations.
- Resolution and exit — repositories, documentation, exports, credentials, step-in, transition, and replacement.
Begin with criticality, not a balance sheet
Classify the engagement before requesting documents. Consider disruption impact, tolerated downtime, data sensitivity, switching difficulty, operating dependency, term, and value. A short discovery may need basic confirmation of legal existence, staffing, capacity, and insurance. An agent tied to customers, regulated decisions, or revenue warrants deeper financial review, ongoing monitoring, tested continuity, and contractual exit.
Build a proportionate evidence room
- Public or audited statements when available; otherwise recent management accounts, cash-flow information, projections, and a formal management representation.
- Cash and runway ranges, financing sources, and events that could change them without forcing sensitive information into public circulation.
- Revenue and customer concentration in ranges, backlog, and commitments—without requesting client names unless needed.
- Insurance certificates, relevant coverage, limits, exclusions, and change-notification procedures.
- Named team, replacement and succession plan, and evidence that knowledge is documented.
- Register of subcontractors, models, cloud, licenses, and dependencies without immediate alternatives.
- Business-continuity plan, latest test evidence, RTO/RPO, and incident communications.
- Exit asset inventory: code, prompts, evaluations, data, logs, documentation, accounts, and export formats.
Protect nonpublic information under appropriate confidentiality terms, limit access to finance and legal reviewers, and record why each item matters. Historical filings age quickly; reconfirm material changes before signature and at later phase gates. A credit score or lack of a rating may prompt investigation, but should not be the sole basis for rejecting a young or privately held firm.
Test the contract, supply chain, and people
Compare contract value, payment timing, delivery cost, and concurrent commitments. An outsized engagement may strain working capital; excessive prepayment transfers risk to the buyer. An abnormally low bid also deserves explanation. Map the parent, affiliates, subcontractors, cloud, external models, and critical people. A guarantee is only as useful as its guarantor; insurance only mitigates covered events. Require notice of material changes, evidence rights, and alternatives for single dependencies.
Run four disruption scenarios
- A funding round or major receivable is delayed 90 days: which teams, services, and commitments remain protected?
- The lead architect or data owner leaves tomorrow: who takes over, with what documentation, and by when?
- A critical model, cloud, or subcontractor changes price, terms, or availability: what alternate route exists?
- The provider is acquired, closes the unit, or enters financial distress: how does service continue and how do assets reach a replacement?
Work the scenarios in a 90-minute session and convert assurances into actions, owners, deadlines, and artifacts. For critical services, conduct a dry run: export sample configuration and data, restore it in a controlled environment, activate communications, and time delivery of emergency exit information. A plan that has never been exercised is intention, not evidence.
Convert risk into mitigations
- Payments tied to accepted outcomes, avoiding disproportionate prepayment.
- Client-controlled cloud accounts, repositories, and data where feasible.
- Named backups, continuous documentation, and recurring knowledge transfer.
- Financial monitoring that matches criticality.
- Defined notice, focused audit, step-in, and transition rights.
- Escrow only when necessary, useful, and testable; guarantees or bonds only when protection justifies cost.
- An internal plan for degraded operations, replacement, or temporary insourcing.
Expensive mitigations can increase price and suppress competition. A smaller provider using client-owned accounts, strong documentation, redundant staffing, and tested exit may offer better continuity than a large group with an opaque supply chain. Monitor liquidity deterioration, payment delays, key turnover, change of control, insurance lapses, expanding subcontracting, outages, and SLA misses. Reassess before expanding scope.
U.S. context and connected gates
Align the review with internal procurement policy, the contracting entity, applicable privacy and sector rules, insurance practice, and state law. Confidential financial information needs controlled handling and qualified interpretation. Use https://makinai.co/insights/en/security-due-diligence-ai-services-company for security, https://makinai.co/insights/en/verify-ai-consulting-case-studies-client-references for history, https://makinai.co/insights/en/how-to-assess-ai-vendor-lock-in-exit-plan for portability, and https://makinai.co/insights/en/ai-services-contract-liability-warranties-indemnities for risk allocation.
When to involve MAKINAI
MAKINAI can help classify criticality, assemble an evidence room, run disruption scenarios, and convert gaps into gates, contract terms, and transition plans. Explore https://makinai.co/services/en/ai-strategy-transformation-consulting. The decision record should name the evidence, residual risk, mitigations, owners, and reassessment trigger.